- Reconnaissance is always the initial step
in a cyberattack.
An attacker definitely need to gather information
about its target to be, actually, successful.
When it comes to reconnaissance,
and basically in a penetration-testing engagement,
we usually think of scanning and enumeration.
But what does a reconnaissance actually looks like
from an attacker perspective?
It's a little bit different.
Let's suppose that we are actually performing a pen-testing
for an organization that owns the domain h4cker.org.
And, of course, you know, h4cker.org is actually
an internet website, so it has an internet presence
as most companies actually do.
Now, this presence is actually a website hosted
somewhere on-premise or in the cloud.
Also, the company may actually have several other systems
in different subdomains and in different networks.
A cyber-attacker needs to determine
everything that is exposed,
and typically he or she will create
a threat model of its victim.
They need to understand what systems, what ports,
what protocols are actually exposed to the Internet.
Now, also, what key individuals
he or she can target with in the organization
to carry social engineering attacks, spear-phishing,
and many other attacks.
Now, there are two ways that you can perform reconnaissance,
both active and passive.
Active reconnaissance is actually
whenever you launch tools and packets
against organizations, its systems, networks,
to enumerate and discover many different vulnerabilities
and anything else that is exposed.
Now, passive reconnaissance is actually the opposite.
You are not actively performing a scan
or launching any tools or packets against the victim.
This is actually done by leveraging
Open Source Intelligence, or OSINT, and public records.
Now, there are examples of different sources
that you can actually, you know,
use to perform passive reconnaissance.
One of them is actually the Google Hacking Database,
DNS records, Shodan, Whois information,
tools like Recon-ng, Maltego, Spiderfoot and many others.
I have a very comprehensive list of passive
and active reconnaissance tools
at the GitHub repository for this course.
Now, in the next lesson, we'll actually go over
many of these tools and resources.